gnutls_pk_algorithm_get_name ()

const char *
gnutls_pk_algorithm_get_name (gnutls_pk_algorithm_t algorithm);

Convert a gnutls_pk_algorithm_t value to a string.

GNUTLS_CURVE_TO_BITS()

#define GNUTLS_CURVE_TO_BITS(curve) (unsigned int)(((unsigned int)1<<31)|((unsigned int)(curve)))

GNUTLS_BITS_TO_CURVE()

#define GNUTLS_BITS_TO_CURVE(bits) (((unsigned int)(bits)) & 0x7FFFFFFF)

GNUTLS_BITS_ARE_CURVE()

#define GNUTLS_BITS_ARE_CURVE(bits) (((unsigned int)(bits)) & 0x80000000)

gnutls_init ()

int
gnutls_init (gnutls_session_t *session,
             unsigned int flags);

This function initializes the provided session. Every session must be initialized before use, and must be deinitialized after used by calling gnutls_deinit().

flags can be any combination of flags from gnutls_init_flags_t.

Note that since version 3.1.2 this function enables some common TLS extensions such as session tickets and OCSP certificate status request in client side by default. To prevent that use the GNUTLS_NO_EXTENSIONS flag.

gnutls_deinit ()

void
gnutls_deinit (gnutls_session_t session);

This function clears all buffers associated with the session . This function will also remove session data from the session database if the session was terminated abnormally.

gnutls_bye ()

int
gnutls_bye (gnutls_session_t session,
            gnutls_close_request_t how);

Terminates the current TLS/SSL connection. The connection should have been initiated using gnutls_handshake(). how should be one of GNUTLS_SHUT_RDWR, GNUTLS_SHUT_WR.

In case of GNUTLS_SHUT_RDWR the TLS session gets terminated and further receives and sends will be disallowed. If the return value is zero you may continue using the underlying transport layer. GNUTLS_SHUT_RDWR sends an alert containing a close request and waits for the peer to reply with the same message.

In case of GNUTLS_SHUT_WR the TLS session gets terminated and further sends will be disallowed. In order to reuse the connection you should wait for an EOF from the peer. GNUTLS_SHUT_WR sends an alert containing a close request.

Note that not all implementations will properly terminate a TLS connection. Some of them, usually for performance reasons, will terminate only the underlying transport layer, and thus not distinguishing between a malicious party prematurely terminating the connection and normal termination.

This function may also return GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED; cf. gnutls_record_get_direction().

gnutls_handshake ()

int
gnutls_handshake (gnutls_session_t session);

This function performs the handshake of the TLS/SSL protocol, and initializes the TLS session parameters.

The non-fatal errors expected by this function are: GNUTLS_E_INTERRUPTED, GNUTLS_E_AGAIN, GNUTLS_E_WARNING_ALERT_RECEIVED. When this function is called for re-handshake under TLS 1.2 or earlier, the non-fatal error code GNUTLS_E_GOT_APPLICATION_DATA may also be returned.

The former two interrupt the handshake procedure due to the transport layer being interrupted, and the latter because of a "warning" alert that was sent by the peer (it is always a good idea to check any received alerts). On these non-fatal errors call this function again, until it returns 0; cf. gnutls_record_get_direction() and gnutls_error_is_fatal(). In DTLS sessions the non-fatal error GNUTLS_E_LARGE_PACKET is also possible, and indicates that the MTU should be adjusted.

When this function is called by a server after a rehandshake request under TLS 1.2 or earlier the GNUTLS_E_GOT_APPLICATION_DATA error code indicates that some data were pending prior to peer initiating the handshake. Under TLS 1.3 this function when called after a successful handshake, is a no-op and always succeeds in server side; in client side this function is equivalent to gnutls_session_key_update() with GNUTLS_KU_PEER flag.

This function handles both full and abbreviated TLS handshakes (resumption). For abbreviated handshakes, in client side, the gnutls_session_set_data() should be called prior to this function to set parameters from a previous session. In server side, resumption is handled by either setting a DB back-end, or setting up keys for session tickets.

gnutls_reauth ()

int
gnutls_reauth (gnutls_session_t session,
               unsigned int flags);

This function performs the post-handshake authentication for TLS 1.3. The post-handshake authentication is initiated by the server by calling this function. Clients respond when GNUTLS_E_REAUTH_REQUEST has been seen while receiving data.

The non-fatal errors expected by this function are: GNUTLS_E_INTERRUPTED, GNUTLS_E_AGAIN, as well as GNUTLS_E_GOT_APPLICATION_DATA when called on server side.

The former two interrupt the authentication procedure due to the transport layer being interrupted, and the latter because there were pending data prior to peer initiating the re-authentication. The server should read/process that data as unauthenticated and retry calling gnutls_reauth().

When this function is called under TLS1.2 or earlier or the peer didn't advertise post-handshake auth, it always fails with GNUTLS_E_INVALID_REQUEST. The verification of the received peers certificate is delegated to the session or credentials verification callbacks. A server can check whether post handshake authentication is supported by the client by checking the session flags with gnutls_session_get_flags().

Prior to calling this function in server side, the function gnutls_certificate_server_set_request() must be called setting expectations for the received certificate (request or require). If none are set this function will return with GNUTLS_E_INVALID_REQUEST.

Note that post handshake authentication is available irrespective of the initial negotiation type (PSK or certificate). In all cases however, certificate credentials must be set to the session prior to calling this function.

gnutls_handshake_set_timeout ()

void
gnutls_handshake_set_timeout (gnutls_session_t session,
                              unsigned int ms);

This function sets the timeout for the TLS handshake process to the provided value. Use an ms value of zero to disable timeout, or GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT for a reasonable default value. For the DTLS protocol, the more detailed gnutls_dtls_set_timeouts() is provided.

This function requires to set a pull timeout callback. See gnutls_transport_set_pull_timeout_function().

Since: 3.1.0

gnutls_rehandshake ()

int
gnutls_rehandshake (gnutls_session_t session);

This function can only be called in server side, and instructs a TLS 1.2 or earlier client to renegotiate parameters (perform a handshake), by sending a hello request message.

If this function succeeds, the calling application should call gnutls_record_recv() until GNUTLS_E_REHANDSHAKE is returned to clear any pending data. If the GNUTLS_E_REHANDSHAKE error code is not seen, then the handshake request was not followed by the peer (the TLS protocol does not require the client to do, and such compliance should be handled by the application protocol).

Once the GNUTLS_E_REHANDSHAKE error code is seen, the calling application should proceed to calling gnutls_handshake() to negotiate the new parameters.

If the client does not wish to renegotiate parameters he may reply with an alert message, and in that case the return code seen by subsequent gnutls_record_recv() will be GNUTLS_E_WARNING_ALERT_RECEIVED with the specific alert being GNUTLS_A_NO_RENEGOTIATION. A client may also choose to ignore this request.

Under TLS 1.3 this function is equivalent to gnutls_session_key_update() with the GNUTLS_KU_PEER flag. In that case subsequent calls to gnutls_record_recv() will not return GNUTLS_E_REHANDSHAKE, and calls to gnutls_handshake() in server side are a no-op.

This function always fails with GNUTLS_E_INVALID_REQUEST when called in client side.

is a <-gnutls.html#gnutls-mrns">